Cisco won’t fix zero-day RCE vulnerability in end-of-life VPN routers

guest · Aug 19, 2021

Cisco won’t fix zero-day RCE vulnerability in end-of-life VPN routers
August 19, 2021
https://www.bleepingcomputer.com/ne...rce-vulnerability-in-end-of-life-vpn-routers/

In a security advisory published on Wednesday, Cisco said that a critical vulnerability in Universal Plug-and-Play (UPnP) service of multiple small business VPN routers will not be patched because the devices have reached end-of-life.

The zero-day bug (tracked as CVE-2021-34730 and rated with a 9.8/10 severity score) is caused by improper validation of incoming UPnP traffic and was reported by Quentin Kaiser of IoT Inspector Research Lab.
Click to expand...

Unauthenticated attackers can exploit it to restart vulnerable devices or execute arbitrary code remotely as the root user on the underlying operating system.

"Cisco has not released and will not release software updates to address the vulnerability described in this advisory," the company says.
"The Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers have entered the end-of-life process."
Click to expand...

While Cisco doesn't plan to release security updates to address this critical vulnerability, admins can remove the attack vector to block attacks by disabling the UPnP service on all impacted routers via their web-based management interface.

"To determine whether the UPnP feature is enabled on the LAN interface of a device, open the web-based management interface and navigate to Basic Settings > UPnP," Cisco added. "If the Disable check box is unchecked, UPnP is enabled on the device."
Click to expand...

guest · Jan 20, 2023

Over 19,000 end-of-life Cisco routers exposed to RCE attacks
By Sergiu Gatlan @serghei - January 20, 2023

Over 19,000 end-of-life Cisco VPN routers on the Internet are exposed to attacks targeting a remote command execution exploit chain.

By chaining two security flaws disclosed last week, threat actors can bypass authentication (CVE-2023-20025) and execute arbitrary commands (CVE-2023-2002) on the underlying operating system of Cisco Small Business RV016, RV042, RV042G, and RV082 routers.
Click to expand...

Unauthenticated attackers can exploit the critical severity auth bypass flaw remotely via specially crafted HTTP requests sent to the vulnerable routers' web-based management interface to gain root access.

Cisco rated CVE-2023-20025 as critical and said that its Product Security Incident Response Team (PSIRT) team is aware of proof-of-concept exploit code available in the wild.
Despite this, the company also said it "has not and will not release software updates that address this vulnerability."
Click to expand...

Thousands of routers vulnerable to attacks
After BleepingComputer reported that these routers would be left without a patch and looking into how many of them are reachable over the Internet, Censys found almost 20,000 RV016, RV042, RV042G, and RV082 Cisco routers online.

"By looking at only HTTP services that include the model numbers in either the 'WWW-Authenticate' response header or an HTTPS service with a matching TLS organizational unit, Censys search results show around 20,000 hosts have indicators that they are potentially vulnerable to this attack," Censys said.
Click to expand...

Censys: CVE-2023-20025 – RCE in End-of-Life Cisco Routers

January 17, 2023
Censys has visibility into 19.5k end-of-life Cisco devices for individuals and small businesses on the internet, which may be vulnerable to a new attack. And to make matters worse, there will not be an official fix.
Click to expand...

Log in or Sign up

Cisco won’t fix zero-day RCE vulnerability in end-of-life VPN routers

guest Guest

guest Guest

Log in or Sign up

Cisco won’t fix zero-day RCE vulnerability in end-of-life VPN routers

guest Guest

guest Guest

Useful Searches